Which versions of OpenClaw are affected by CVE-2026-43531?

OpenClaw npm package versions before 2026.4.9 contain an environment variable injection vulnerability that allows local attackers with low privileges to redirect package updates, intercept gateway…. A patch is available.

How to fix or mitigate CVE-2026-43531?

Within 24 hours: Inventory all projects and systems using OpenClaw npm package and verify installed versions. Within 7 days: Upgrade OpenClaw to version 2026.4.9 or later (2026.4.14 recommended) across all affected environments; validate upgrades in development/staging first. Within 30 days: Audit shared workspace configurations, implement file permissions restrictions on .env files in version control systems, and conduct supply-chain risk review for any packages pulled during the vulnerable window.

OpenClaw CVE-2026-43531

Q: What is the CVSS score of CVE-2026-43531?

CVE-2026-43531 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-27273 HIGH

External Control of System or Configuration Setting (CWE-15)

2026-05-05 VulnCheck

Code Injection Openclaw

7.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.0 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Updated

May 05, 2026 - 12:49 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 05, 2026 - 12:37 vuln.today

cvss_changed

CVSS changed

May 05, 2026 - 12:37 NVD

7.3 (HIGH) 7.0 (HIGH)

Source Code Evidence Fetched

May 05, 2026 - 12:19 vuln.today

Analysis Generated

May 05, 2026 - 12:19 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on openclaw (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.4.9.

DescriptionCVE.org

OpenClaw before 2026.4.9 contains an environment variable injection vulnerability allowing malicious workspace .env files to set runtime-control variables. Attackers can inject variables affecting update sources, gateway URLs, ClawHub resolution, and browser executable paths to compromise application behavior.

AnalysisAI

Environment variable injection in OpenClaw npm package versions before 2026.4.9 allows local attackers with low privileges to compromise application behavior through malicious workspace .env files. Attackers can redirect update sources to serve backdoored packages, modify gateway URLs and ClawHub resolution endpoints to intercept traffic, and override browser executable paths to launch attacker-controlled binaries. Vendor-released patch: version 2026.4.9, with fix also present in latest npm release 2026.4.14. No public exploit identified at time of analysis, but exploitation requires only an untrusted repository with a crafted .env file opened by a victim user.

Technical ContextAI

This vulnerability (CWE-15: External Control of System or Configuration Setting) affects the dotenv configuration loading mechanism in OpenClaw, an npm package for AI-assisted development workflows. The affected product (cpe:2.3:a:openclaw:openclaw) loads workspace-local .env files to set environment variables but failed to filter runtime-control variables before version 2026.4.9. The commit dbfcef319618158fa40b31cdac386ea34c392c0c introduces a comprehensive blocklist of 37 sensitive variable names and six prefix families (OPENCLAW_UPDATE_*, OPENCLAW_SKIP_*, OPENCLAW_DISABLE_*, OPENCLAW_CLAWHUB_*, CLAWHUB_*, ANTHROPIC_API_KEY_*) to prevent workspace .env files from hijacking application runtime behavior. The fix preserves user-defined environment variables (like GITHUB_TOKEN, DATABASE_URL_CUSTOM) while blocking variables controlling update mechanisms (OPENCLAW_UPDATE_PACKAGE_SPEC), network routing (OPENCLAW_GATEWAY_URL, CLAWHUB_URL), authentication tokens (CLAWHUB_TOKEN, CLAWHUB_AUTH_TOKEN), binary execution paths (BROWSER_EXECUTABLE_PATH, PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH), plugin catalog sources (OPENCLAW_PLUGIN_CATALOG_PATHS), and diagnostic controls (OPENCLAW_SHOW_SECRETS). The vulnerability exists because workspace .env files, intended for project-specific configuration, could override system-level security controls designed to protect the OpenClaw runtime environment.

RemediationAI

Upgrade the OpenClaw npm package to version 2026.4.9 or later, with 2026.4.14 recommended as the current stable release incorporating the fix. Execute 'npm update openclaw' or modify package.json to specify '"openclaw": "^2026.4.9"' and run 'npm install'. The fix is implemented in commit dbfcef319618158fa40b31cdac386ea34c392c0c and merged via pull request #62660, both linked in the GitHub advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-7wv4-cc7p-jhxc. The patch introduces a blocklist of 37 runtime-control variables and six prefix families to prevent workspace .env files from injecting sensitive configuration. If immediate upgrade is not feasible, implement compensating controls: (1) Restrict workspace .env file permissions to read-only for the OpenClaw process user to prevent runtime modification, though this does not block load-time injection; (2) Conduct manual code review of all .env files in cloned repositories before opening workspaces, searching for blocked variable names listed in the advisory (OPENCLAW_UPDATE_PACKAGE_SPEC, OPENCLAW_GATEWAY_URL, BROWSER_EXECUTABLE_PATH, CLAWHUB_TOKEN, etc.) - this is labor-intensive and error-prone; (3) Run OpenClaw in a sandboxed environment (container, VM) with network egress filtering to prevent gateway redirection and update source compromise, accepting the operational overhead of managing isolated development environments. These workarounds introduce significant friction to developer workflows and do not fully mitigate the vulnerability; upgrading to the patched version remains the only complete remediation.